Executive Summary

This vulnerability exists in OpenClaw versions before 2026.5.18 and involves a code execution flaw. Specifically, the marketplace runtime extension metadata can be manipulated to redirect the loading process toward unscanned package payloads. Attackers who have trusted operator access can exploit this by altering the extension metadata to load plugin code from outside the reviewed and security-scanned package entry points, effectively bypassing security scanning.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers with trusted operator access to execute arbitrary code by loading unscanned and potentially malicious plugin code. This can lead to unauthorized code execution within the OpenClaw environment, potentially compromising system integrity, confidentiality, and availability.

Useful 0 Not Useful 0